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Do completely unpredictable events exist in nature? Classical theory, being fully deterministic, completely 
excludes fundamental randomness. On the contrary, quantum theory allows for randomness within its axiomatic 
structure. Yet, the fact that a theory makes prediction only in probabilistic terms does not imply the existence of 
any form of randomness in nature. The question then remains whether one can certify randomness independent 
of the physical framework used. While standard Bell tests 1 1] approach this question from this perspective, they 
require prior perfect randomness, which renders the approach circular. Recently, it has been shown that it is 
possible to certify full randomness using almost perfect random bits |2|. Here, we prove that full randomness 
can indeed be certified using quantum non-locality under the minimal possible assumptions: the existence of a 
source of arbitrarily weak (but non-zero) randomness and the impossibility of instantaneous signalling. Thus 
we are left with a strict dichotomic choice: either our world is fully deterministic or there exist in nature events 
that are fully random. Apart from the foundational implications, our results represent a quantum protocol for 
full randomness amplification, an information task known to be impossible classically jSj- Finally, they open a 
new path for device-independent protocols under minimal assumptions. 



Understanding whether nature is deterministically pre- 
determined or there are intrinsically random processes is 
a fundamental question that has attracted the interest of 
multiple thinkers, ranging from philosophers and mathe- 
maticians to physicists or neuroscientists. Nowadays this 
question is also important from a practical perspective, as 
random bits constitute a valuable resource for applications 
such as cryptographic protocols, gambling, or the numeri- 
cal simulation of physical and biological systems. 

Classical physics is a deterministic theory. Perfect 
knowledge of the positions and velocities of a system of 
classical particles at a given time, as well as of their inter- 
actions, allows one to predict their future (and also past) 
behavior with total certainty |4|. Thus, any randomness 
observed in classical systems is not intrinsic to the theory 
but just a manifestation of our imperfect description of the 
system. 

The advent of quantum physics put into question this 
deterministic viewpoint, as there exist experimental situa- 
tions for which quantum theory gives predictions only in 
probabilistic terms, even if one has a perfect description 
of the preparation and interactions of the system. A pos- 
sible solution to this classically counterintuitive fact was 
proposed in the early days of quantum physics: Quantum 
mechanics had to be incomplete |5|, and there should be 
a complete theory capable of providing deterministic pre- 
dictions for all conceivable experiments. There would thus 
be no room for intrinsic randomness, and any apparent ran- 
domness would again be a consequence of our lack of con- 
trol over hypothetical "hidden variables" not contemplated 
by the quantum formalism. 

Bell's no-go theorem [l], however, implies that hidden- 
variable theories are inconsistent with quantum mechan- 
ics. Therefore, none of these could ever render a deter- 
ministic completion to the quantum formalism. More pre- 
cisely, all hidden-variable theories compatible with a local 
causal structure predict that any correlations among space- 
like separated events satisfy a series of inequalities, known 
as Bell inequalities. Bell inequalities, in turn, are violated 
by some correlations among quantum particles. This form 



of correlations defines the phenomenon of quantum non- 
locality. 

Now, it turns out that quantum non-locality does not 
necessarily imply the existence of fully unpredictable pro- 
cesses in nature. The reasons behind this are subtle. First 
of all, unpredictable processes could be certified only if the 
no-signalling principle holds. This states that no instanta- 
neous communication is possible, which imposes in turn 
a local causal structure on events, as in Einstein's special 
relativity. In fact, Bohm's theory is both deterministic and 
able to reproduce all quantum predictions |6 |, but it is in- 
compatible with no-signalling. Thus, we assume through- 
out the validity of the no-signalling principle. Yet, even 
within the no-signalling framework, it is still not possible 
to infer the existence of fully random processes only from 
the mere observation of non-local correlations. This is due 
to the fact that Bell tests require measurement settings cho- 
sen at random, but the actual randomness in such choices 
can never be certified. The extremal example is given when 
the settings are determined in advance. Then, any Bell vi- 
olation can easily be explained in terms of deterministic 
models. As a matter of fact, super-deterministic models, 
which postulate that all phenomena in the universe, includ- 
ing our own mental processes, are fully pre-programmed, 
are by definition impossible to rule out. 

These considerations imply that the strongest result on 
the existence of randomness one can hope for using quan- 
tum non-locality is stated by the following possibility: 
Given a source that produces an arbitrarily small but non- 
zero amount of randomness, can one still certify the exis- 
tence of completely random processes? The main result 
of this work is to provide an affirmative answer to this 
question. Our results, then, imply that the existence of 
correlations as those predicted by quantum physics forces 
us into a dichotomic choice: Either we postulate super- 
deterministic models in which all events in nature are fully 
pre-determined, or we accept the existence of fully unpre- 
dictable events. 

Besides the philosophical and physics-foundational im- 
phcations, our results provide a protocol for perfect ran- 
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FIG. 1 : Local causal structure and randomness amplification. 

A source 5 produces a sequence xi, X2, ■ ■ ■ Xj , . . . Change Xj in 
the figure to a::j , . . . of imperfect random bits. The goal of ran- 
domness amplification is to produce a new source 5/ of perfect 
random bits, that is, to process the initial bits to get a final bit k 
fully uncorrelated (free) from any potential cause of it. All space- 
time events outside the future light-cone of k may have been in its 
past light-cone before and therefore constitute a potential cause 
of it. Any such event can be modeled by a measurement z, with 
an outcome e, on some physical system. This system may be un- 
der the control of an adversary Eve, interested in predicting the 
value of k. 



domness amplification using quantum non-locality. Ran- 
domness amplification is an information-theoretic task 
whose goal is to use an input source S of imperfectly ran- 
dom bits to produce perfect random bits that are arbitrarily 
uncorrelated from all the events that may have been a po- 
tential cause of them, i.e. arbitrarily free. In general, S 
produces a sequence of bits xi, X2, ■ ■ ■ Xj, . . ., with xj — 
or 1 for all j, see Fig. [T] Each bit j contains some random- 
ness, in the sense that the probability P {xj\e) that it takes 
a given value Xj, conditioned on any pre-existing variable 
e, is such that 

e< P{xj\e) <l-e (1) 

for all j and e, where < e < 1/2. The variable e can cor- 
respond to any event that could be a possible cause of bit 
Xj. Therefore, e represents events contained in the space- 
time region lying outside the future light-cone of Xj . Free 
random bits correspond to e = ^; while deterministic ones, 
i.e. those predictable with certainty by an observer with ac- 
cess to e, to e = 0. More precisely, when e = the bound 
( |Cl| l is trivial and no randomness can be certified. We re- 
fer to S as an e-source, and to any bit satisfying ( |Cl| l as 
an e-free bit. The aim is then to generate, from arbitrarily 
many uses of S, a final source Sf of e/ arbitrarily close to 
1/2. If this is possible, no cause e can be assigned to the 
bits produced by Sf, which are then fully unpredictable. 
Note that efficiency issues, such as the rate of uses of S 
required per final bit generated by 5/ do not play any role 
in randomness amplification. The relevant figure of merit 



is just the quality, measured by e/, of the final bits. Thus, 
without loss of generality, we restrict our analysis to the 
problem of generating a single final free random bit k. 

Santha and Vazirani proved that randomness amplifica- 
tion is impossible using classical resources f3l. This is in a 
sense intuitive, in view of the absence of any intrinsic ran- 
domness in classical physics. In the quantum regime, ran- 
domness amplification has been recently studied by Col- 
beck and Renner |2|. There, S is used to choose the mea- 
surement settings by two distant observers, Alice and Bob, 
in a Bell test |7| involving two entangled quantum parti- 
cles. The measurement outcome obtained by one of the 
observers, say Alice, in one of the experimental runs (also 
chosen with S) defines the output random bit. Colbeck 
and Renner proved how input bits with very high random- 
ness, of 0.442 < e < 0.5, can be mapped into arbitrarily 
free random bits of e/ — > 1/2, and conjectured that ran- 
domness amplification should be possible for any initial 
randomness |2|. Our results also solve this conjecture, as 
we show that quantum non-locality can be exploited to at- 
tain/w// randomness amplification, i.e. that ej can be made 
arbitrarily close to 1/2 for any < e < 1/2. 

Before presenting the ingredients of our proof, it is 
worth commenting on previous works on randomness in 
connection with quantum non-locality. In |8 1 it was shown 
how to bound the intrinsic randomness generated in a Bell 
test. These bounds can be used for device-independent ran- 
domness expansion, following a proposal by Colbeck ||9l, 
and to achieve a quadratic expansion of the amount of ran- 
dom bits |8| (see |10-13| for further works on device- 
independent randomness expansion). Note however that, 
in randomness expansion, one assumes instead, from the 
very beginning, the existence of an input seed of free ran- 
dom bits, and the main goal is to expand this into a larger 
sequence. The figure of merit there is the ratio between 
the length of the final and initial strings of free random 
bits. Finally, other recent works have analyzed how a lack 
of randomness in the measurement choices affects a Bell 
test 1,14,-16 1 and the randomness generated in it [17] . 

Let us now sketch the realization of our final source Sf. 
We use the input e-source S to choose the measurement 
settings in a multipartite Bell test involving a number of 
observers that depends both on the input e and the target 
Ef. After verifying that the expected Bell violation is ob- 
tained, the measurement outcomes are combined to define 
the final bit k. For pedagogical reasons, we adopt a cryp- 
tographic perspective and assume the worst-case scenario 
where all the devices we use may have been prepared by an 
adversary Eve equipped with arbitrary non-signalling re- 
sources, possibly even supra-quantum ones. In the prepa- 
ration. Eve may have also had access to S and correlated 
the bits it produces with some physical system at her dis- 
posal, represented by a black box in Fig. [T] Without loss 
of generality, we can assume that Eve can reveal the value 
of e at any stage of the protocol by measuring this system. 
Full randomness amplification is then equivalent to prov- 
ing that Eve's correlations with k can be made arbitrarily 
small. 

Bell tests for which quantum correlations achieve 
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FIG. 2: Protocol for full randomness amplification based on quantum non-locality. In the first two steps, all TV quintuplets measure 
their devices, where the choice of measurement is done using the e-source 5; the quintuplets whose settings happen not to take place 
in the five-party Mermin inequality are discarded (in red). In steps 3 and 4, the remaining quintuplets are grouped into blocks. One of 
the blocks is chosen as the distillation block, using again 5, while the others are used to check the Bell violation. In the fifth step, the 
random bit k is extracted from the distillation block. 



the maximal non-signalling violation, also known as 
Greenberger-Horne-Zeilinger (GHZ) paradoxes fTSl, are 
necessary for randomness amplification. This is due to 
the fact that unless the maximal non-signalling violation 
is attained, for sufficiently small e, Eve may fake the ob- 
served correlations with classical deterministic resources. 
This attack ceases to be possible when the maximal non- 
signalling violation is observed, as Eve is forced to pre- 
pare only those non-local correlations attaining the maxi- 
mal violation. GHZ paradoxes are however not sufficient. 
Consider for instance the GHZ paradox given by the tri- 
partite Mermin Bell inequality lfT9l . One can see that Eve 
can predict with certainty any function of the measurement 
outcomes and still deliver the maximal violation, for all 
< e < 1/2 (see Appendix|B]i. 

For more parties though, the latter happens not to hold 
any longer. In fact, consider any correlations attaining 
the maximal violation of the five-party Mermin inequality. 
Take the bit corresponding to the majority-vote function 
of the outcomes of any subset of three out of the five ob- 
servers, say the first three. This function is equal to zero 
if at least two of the three bits are equal to zero, and equal 
to one otherwise. We show in Appendix [B] that Eve's pre- 
dictability on this bit is at most 3/4. This is our first result; 



Result 1. Given an e-source with any < e < 1/2, and 
quantum five-party non-local resources, an intermediate 
e^-source of ei — 1/4 can be obtained. 

The partial unpredictability in the five-party Mermin 
Bell test is the building block of our protocol. To com- 
plete it, we must equip it with two essential components: 
(/) an estimation procedure that verifies that the untrusted 
devices do yield the required Bell violation; and (//) a dis- 
tillation procedure that, from sufficiently many e^-bits gen- 
erated in the 5-party Bell experiment, distills a single fi- 
nal e/-source of e/ — > 1/2. To these ends, we consider 
a more complex Bell test involving N groups of five ob- 
servers (quintuplets) each, as depicted in Fig. |2] The steps 
in the protocol are described in Box 1 . 

In the appendices we prove using techniques from EOl 
that, if the protocol is not aborted, the final bit produced 
by the protocol is indistinguishable from an ideal random 
bit uncorrelated to the eavesdropper. Thus, the output free 
random bits satisfy universally-composable security 0, 
the highest standard of cryptographic security, and could 
be used as seed for randomness expansion or any other 
protocol. 

Finally, we must show that quantum resources can in- 
deed successfully implement our protocol. It is immediate 
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Box 1: Protocol for Randomness Amplification 

1 . Every observer measures his device in one of two settings 
ciiosen at random by the input e-source 5. 

2. Every quintuplet whose settings combination does not 
appear in the five-party Mermin Bell test is discarded. 
If the quintuplets left are fewer than abort. 

3. Group the quintuples left into Nb blocks of equal size 
Nd- Choose a distillation block at random with 5. 

4. If the outcomes of any quintuplet not in the distillation 
block are inconsistent with the maximal violation of the 
five-party Mermin Bell test, abort. 

5. Distill the final bit from the distillation block. This is 
done in the following way. The majority vote maj(a) 
among for instance the outcomes ai, a2 and as of the 
first three users is computed for each quintuplet. Then, a 
function / maps the resulting Nd bits into the final bit k. 



to see that the qubit measurements X or y on the quan- 
tum state l^-) = ^(100000) + |11111)), with |0) and 
|1) the eigenstates of the Z qubit basis, yield correlations 
that maximally violate the five-partite Mermin inequality 
in question. This completes our main result. 

Result 2 (Main Result). Given an e-source with any < 
e < 1 /2, a perfect free random bit k can be obtained using 
quantum non-local correlations. 

In summary, we have presented a protocol that, using 
quantum non-local resources, attains /m// randomness am- 
plification. This task is impossible classically and was not 



known to be possible in the quantum regime. As our goal 
was to prove full randomness amplification, our analysis 
focuses on the noise-free case. In fact, the noisy case only 
makes sense if one does not aim at perfect random bits and 
bounds the amount of randomness in the final bit. Then, it 
should be possible to adapt our protocol in order to get a 
bound on the noise it tolerates. Other open questions that 
naturally follow from our results consist of studying ran- 
domness amplification against quantum eavesdroppers, or 
the search of protocols in the bipartite scenario. 

From a more fundamental perspective, our results im- 
ply that there exist experiments whose outcomes are fully 
unpredictable. The only two assumptions for this conclu- 
sion are the existence of events with an arbitrarily small 
but non-zero amount of randomness and the validity of the 
no-signalling principle. Dropping the former implies ac- 
cepting a super-determinisitc view where no randomness 
exist, so that we experience a fully pre-determined reality. 
This possibility is uninteresting from a scientific perspec- 
tive, and even uncomfortable from a philosophical one. 
Dropping the latter, in turn, implies abandoning a local 
causal structure for events in space-time. However, this is 
one of the most fundamental notions of special relativity, 
and without which even the very meaning of randomness 
or predictability would be unclear, as these concepts im- 
plicitly rely on the cause-effect principle. 
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Appendix A: Mermin inequalities 

The 5-party Mermin inequality |3 1 plays a central role in our construction. In each run of this Bell test, measurements (inputs) 
x=(a;i,...,a;5)on five distant black boxes generate 5 outcomes (outputs) a = {ai, . . . ,05), distributed according to a non-signaling 
conditional probability distribution P(a|x). Both inputs and outputs are bits, as they can take two possible values, Xi,ai £ {0, 1} with 
i = 1, . . . ,5. The inequality can be written as 

^/(a,x)P(a|x)>6, (Al) 

with coefficients 

/(a, x) = (ai e 02 e as e 04 e as) S^exo + (ai a2 03 a4 05 1) 5xeA-i , (A2) 



where 



and 



1 if X G ^"0 
if X ^ ^"0 



Xo = {(10000), (01000), (00100), (00010), (00001), (11111)}, 

Xi = {(00111), (01011), (01101), (OHIO), (10011), (10101), (10110), (11001), (11010), (11100)}. 

That is, only half of all possible combinations of inputs, namely those in A" = Ab U A"! , appear in the Bell inequality. 

The maximal, non-signalling and algebraic, violation of the inequality corresponds to the situation in which the left-hand side of ( |A1[ | 
is zero. The key property of inequality ( |A1[ | is that its maximal violation can be attained by quantum correlations. In fact, Mermin 
inequalities are defined for an arbitrary number of parties and quantum correlations attain the maximal non- signalling violation for any 
odd number of parties \4i. This violation is always attained by performing local measurements on a GHZ quantum state. 



Appendix B: Partial unpredictability in tlie five-party Mermin inequality 

Our interest in Mermin inequalities comes from the fact that, for an odd number of parties, they can be maximally violated by 
quantum correlations. These correlations, then, define a GHZ paradox, which, as explained in the main text, is necessary for full 
randomness amplification. As also mentioned in the main text, GHZ paradoxes are however not sufficient. In fact, it is always possible 
to find non-signalling correlations that (i) maximally violate the 3-party Mermin inequality but (ii) assign a deterministic value to any 
function of the measurement outcomes. This observation can be checked for all unbiased functions mapping {0, 1}^ to {0, 1} (there are 
(^) of those) through a linear program analogous to the one used to prove the next Theorem. For a larger number of parties, however, 
some functions cannot be deterministically fixed to an specific value while maximally violating a Mermin inequality, as implied by the 
following Theorem. 

Tlieorem 1. Let a five-party non-signaling conditional probability distribution P(a|x) in which inputs x — {xi, . . . , X5) and outputs 
a = (ai, . . . , as) are bits. Consider the bit maj(a) G {0, 1} defined by the majority-vote function of any subset consisting of three of 
the five measurement outcomes, say the first three, ai, a2 and as. Then, all non-signalling correlations attaining the maximal violation 
of the 5-party Mermin inequality are such that the probability that maj(a) takes a given value, say 0, is bounded by 

1/4 < P(maj(a) = 0) < 3/4. (Bl) 

Proof. This result was obtained by solving a linear program. Therefore, the proof is numeric, but exact. Formally, let P(a|x) be a 
5-partite no-signaling probability distribution. For x = xo G X, we performed the maximization, 

Prnax = max P(maj(a) = 0|xo) 
subject to 

(B2) 

/(a,x) ■ P(aix) = 

which yields the value Pmax — 3/4. Since the same result holds for P(maj(a) = l|xo), we get the bound 1/4 < P(maj(a) = 0) < 
3/4. 

As a further remark, note that a lower bound to Pmax can easily be obtained by noticing that one can construct conditional probability 
distributions P(a|x) that maximally violate 5-partite Mermin inequality \Al\ for which at most one of the output bits (say ai) is 
deterministically fixed to either or 1. If the other two output bits (02, as) were to be completely random, the majority-vote of the 
three of them maj (ai , a2 , 03 ) could be guessed with a probability of 3/4. Our numerical results say that this turns out to be an optimal 
strategy. 

□ 

Theorem[T]implies Result 1 in the main text. Moreover it constitutes the simplest GHZ paradox in which some randomness can be 
certified. This paradox is the building block of our randomness amplification protocol, presented in the next section. 
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Appendix C: Protocol for full randomness amplification 



In this section, we describe with more details the protocol summarized in Box 1 of the main text. The protocol uses as resources the 
e-source S and 5A'' quantum systems. Recall that the bits produced by the source 5 are such that the probability P {xj\e) that bit j 
takes a given value Xj, conditioned on any pre-existing variable e, is bounded by 

e<P{xj\e)<l~e, (CI) 

for all j and e, where < e < 1/2. The bound, when applied to n-bit strings produced by the e-source, implies that 

e" <P(2;i,...,s„|e) < (1-e)". (C2) 

Each of the quantum systems is abstractly modeled by a black box with binary input x and output a. The protocol processes classically 
the bits generated by 5 and by the quantum boxes. The result of the protocol is a classical symbol k, associated to an abort/no-abort 
decision. If the protocol is not aborted, k encodes the final output bit, with possible values or 1. Whereas when the protocol is 
aborted, no numerical value is assigned to k but the symbol instead, representing the fact that the bit is empty. The formal steps of 
the protocol are: 

1. 5 is used to generate N quintuple-bits xi, . . . xjv, which constitute the inputs for the 5N boxes. The boxes then provide A'^ 
output quintuple-bits ai , . . . ajv . 

2. The quintuplets such that x ^ A' are discarded. The protocol is aborted if the number of remaining quintuplets is less than N/3. 

3. The quintuplets left after step 2 are organized in Nb blocks each one having Nd quintuplets. The number Nb of blocks is chosen 
to be a power of 2. For the sake of simplicity, we relabel the index running over the remaining quintuplets, namely xi , . . . xjv^atj 
and outputs ai, . . . ajvj^jv^. The input and output of the j-th block are defined as yj — (x(j_i)jv^_|.i, . . . X(j_i)jVjj+]Vd) and 
bj — (a(j_i)jvj_|_i, ... a(j_i)jv^_i_jVj) respectively, with j G {l,...,Nb}. The random variable i £ {1, ... A'^j,} is generated by 
using logj A'^i, further bits from 5. The value of / specifies which block {bi,yi) is chosen to generate k, i.e. the distilling block. 
We define (6, y) = {bi,yi). The other TV;, — 1 blocks are used to check the Bell violation. 

4. The function 

^[^^j^j^/l if /(ai,xi) = ••• =/(aiv^,XivJ =0 ^^2) 
1 otherwise 

tells whether block (6, y) features the right correlations (r = 1) or the wrong ones (r — 0), in the sense of being compatible 
with the maximal violation of inequality i|ATJ. This function is computed for all blocks but the distilling one. The protocols is 
aborted unless all of them give the right correlations. 



n 



r, 1 i 1 not abort 
r[bj,yj] = <^ „ , • (C4) 

abort 



Note that the abort/no-abort decision is independent of whether the distilling block I is right or wrong. 
5. If the protocol is not aborted then k is assigned a bit generated from 6; — (ai , . . . ajv^ ) as 

fc = /(maj(ai), . . .maj(aiv^)) . (C5) 

Here / : {0, 1}^'' — )■ {0, 1} is a function characterized in Lemma|4]below, while maj(ai) G {0, 1} is the majority-vote among 
the three first bits of the quintuple string a^. If the protocol is aborted it sets k = 0. 

At the end of the protocol, k is potentially correlated with the settings of the distilling block y = yi, the bit g in ^C4\ , and the bits 

t = [I, ibi,yi), ■ ■ ■ {bi-i,yi-i), {bi+i,yi+i), . . . (6iv,,y]vJ]. 

Additionally, an eavesdropper Eve might have a physical system correlated with k, which she may measure at any instance of the 
protocol. This system is not necessarily classical or quantum, the only assumption about it is that measuring it does not produce 
instantaneous signaling anywhere else. We label all possible measurements Eve can perform with the classical variable z, and with 
e the corresponding outcome. In summary, after the performance of the protocol all the relevant information is k, y, t, g, e, z, with 
statistics described by an unknown conditional probability distribution P{k, y, t, g, e\z). 

To assess the security of our protocol for full randomness amplification, we have to show that the distribution describing the protocol 
when not aborted is indistinguishable from the distribution Pideai(A:, y, t, g, e\zg = 1) = \P{y, t, e\zg — 1) describing an ideal free 
random bit. For later purposes, it is convenient to cover the case when the protocol is aborted with an equivalent notation: if the protocol 
is aborted, we define P{k, y, t, e\zg = 0) — 5^ P{y, t, &\zg ~ 0) and Pidcai(fc, y, t, e\zg = 0) = (5f P{y, t, e\zg = 0), where 5^ 
is a Kronecker's delta. In this case, it is immediate that P = Pidcai, as the locally generated symbol is always uncorrelated to the 
environment. To quantify the indistinguishability between P and Pidcai, we consider the scenario in which an observer, having access 
to all the information k, y, t, g, e, z, has to correctly distinguish between these two distributions. We denote by P(guess) the optimal 
probability of correctly guessing between the two distributions. This probability reads 

P(guess) = ^ + I max^ jp(fc,y,t,5(,e|z) - Pidcai(fc,y,i,sr,e|z)|, (C6) 
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where the second term can be understood as (one fourth of) the variational distance between P and Pidcai generahzed to the case when 
the distributions are conditioned on an input z f6\. If the protocol is such that this guessing probabihty can be made arbitrarily close 
to 1/2, it generates a distribution P that is basically undistinguishable from the ideal one. This is known as "universally-composable 
security", and accounts for the strongest notion of cryptographic security (see |5| and [6|). It implies that the protocol produces a 
random bit that is secure (free) in any context. In particular, it remains secure even if the adversary Eve has access to y, t and g. 
Our main result, namely the security of our protocol for full randomness amplification, follows from the following Theorem. 

Theorem 2 (Main Theorem). Consider the previous protocol for randomness amplification and the conditional probability distribution 
P(k,y,t,g,e\z) describing the statistics of the bits k,y,t,g generated during its execution and any possible system with input z 
and output e correlated to them. The probability P(guess) of correctly guessing between this distribution and the ideal distribution 

fidoai(fc, y, t, g, e\z) is such that 

P(guess) < ^ + [a""" + 2 7V^°^^'^-^' (32/3e-^)^^] . (C7) 

where a and /3 are real numbers such that < a < 1 < /?. 

The right-hand side of JcTb can be made arbitrary close to 1/2, for instance by setting A^i, = (32 /3 e"^)^^'*''' and 
increasing subject to the fulfillment of the condition NdNi, > N/3. [Note that log2(l — e) < 0.] In the limit P(guess) — ^ 1/2, 
the bit k generated by the protocol is indistinguishable from an ideal free random bit. 

The proof of Theorem|2]is provided in the next section. Before moving to it, we would like to comment on the main intuitions behind 
our protocol. As mentioned, the protocol builds on the 5-party Mermin inequality because it is the simplest GHZ paradox allowing 
some randomness certification. The estimation part, given by step 4, is rather standard and inspired by estimation techniques introduced 
in (T), which were also used in [2| in the context of randomness amplification. The most subtle part is the distillation of the final bit in 
step 5. Naively, and leaving aside estimation issues, one could argue that it is nothing but a classical processing by means of the function 
/ of the imperfect random bits obtained via the Nd quintuplets. But this seems in contradiction with the result by Santha and Vazirani 
proving that it is impossible to extract by classical means a perfect free random bit from imperfect ones 1 1 1. This intuition is however 
wrong. The reason is because in our protocol the randomness of the imperfect bits is certified by a Bell violation, which is impossible 
classically. Indeed, the Bell certification allows applying techniques similar to those obtained in Ref. 16| in the context of privacy 
amplification against non-signalling eavesdroppers. There, it was shown how to amplify the privacy, that is the unpredictability, of one 
of the measurement outcomes of bipartite correlations violating a Bell inequality. The key point is that the amplification, or distillation, 
was attained in a deterministic manner. That is, contrary to standard approaches, the privacy amplification process described in |6l 
does not consume any randomness. Clearly, these deterministic techniques are extremely convenient for our randomness amplification 
scenario. In fact, the distillation part in our protocol can be seen as the translation of the privacy amplification techniques of Ref. |6| to 
our more complex scenario, involving now 5-party non-local correlations and a function of three of the measurement outcomes. 



Appendix D: Proof of Theorem |2] 

Before entering the details of the proof of Theorem|2] let us introduce a convenient notation. In what follows, we sometimes treat 
conditional probability distributions as vectors. To avoid ambiguities, we explicitly label the vectors describing probability distributions 
with the arguments of the distributions in upper case. Thus, for example, we denote by P(A|X) the (2^ x 2'') -dimensional vector with 
components P(a|x) for all a, x G {0, 1}^. We also denote by I the vector with components /(a, x) given in \A2\ . With this notation, 
inequality jAl[ ) can be written as the scalar product 

/ • P(AiX) = ^ J(a, x)P(ajx) > 6 . 

a,x 

Any probability distribution P(a|x) satisfies C ■ P(A]X) = 1, where C is the vector with components C(a, x) — 2~^. We also use 
this scalar-product notation for full blocks, as in 



E^lVrf xi,...xjv , 



P(ai,...ajvJxi,...xjvJ 



Following our upper/lower-case convention, the vector P{B\Y, e, z) has components P(h\y, e, z) for all b, y but fixed e, z. 

The proof of Theorem|2]relies on two crucial lemmas, which are stated and proven in Sections [P l| and [b2| respectively. The first 
lemma bounds the distinguishability between the distribution distilled from a block of Nd quintuplets and the ideal free random bit as 
function of the Bell violation in each quintuplet. In particular, it guarantees that, if the correlations of all quintuplets in a given 
block violate inequality ([aTJ sufficiently much, the bit distilled from the block will be indistinguishable from an ideal free random 
bit. The second lemma is required to guarantee that, if the statistics observed in all blocks but the distilling one are consistent with a 
maximal violation of inequality | |A1[ (, the violation of the distilling block will be arbitrarily large. 

Proof of Theorem|2l We begin with the identity 



P(guess) = P{g = 0)P(guess|5 = 0) + P{g = l)P(guess|5 = 1) 



(Dl) 



8 



As discussed, when the protocol is aborted (g = 0) the distribution generated by the protocol and the ideal one are indistinguishable. 
In other words, 

P(guess|5 = 0) = ^ . (D2) 

If P{g = 0) = 1 then the protocol is secure, though in a trivial fashion. Next we address the non-trivial case where P{g = 1) > 0. 
From formula we have 

P(guess|fl = 1) 

^ ^ + i max^ \p{k,y,t,e\z,g = 1) - ^P{y,t, e\z, g = 1)| 



k,y,t 



\ + \ ^P{y^Ag = \p{k,e\z,y,t,g = 1) - ]^P{e\z,y,t,g = 1)| 



1 1 



+ I E = 1) 6^ + P^ f" ■ P(B\Y, t,g = l) 



2 4 



= ^ + ^ («C + /3/)«^'^ . ^ P{t\g = l)P(Biy, i, 3 = 1) 

t 

1 + ^ (aC7 + /3/)«^'' . ^ P(S, tjy, g = 1) 



2 2 

1 3^/]Vd 

2 2 



(aC + /3/)*^™''-P(B|F,<7 = 1) 



(D3) 



where the inequality is due to Lemma[T]in Section D 1 we have used the no-signalling condition through t\z,g = P{y, t\g = 



1), in the second equality, and Bayes rule in the second and sixth equalities. From l |D3[ l and Lemma[2]in Section 



D2 



we obtain 



P(guess|(; = 1) < 



1 , SVN~d 



log2(l-e) 



P{9 



(32/3.-^) 



Finally, substituting bound l |D4[ ) and equality l |D2| l into \Dl\ , we obtain 



which, together with P{g = 1) < 1, implies i C7 1, 



(D4) 

(D5) 

□ 



1. Statement and proof of Lemma[T] 

As mentioned. Lemma [T| provides a bound on the distinguishability between the probability distribution obtained after distilling a 
block of Nd quintuplets and an ideal free random bit in terms of the Bell violation | |A1^ in each quintuplet. The proof of Lemma[T| in 
turn, requires two more lemmas, Lemma[3]and Lemma|4] stated and proven in Section |D31 

Lemma 1. For each integer Nd > 130 there exists a function / : {0, 1}'^'' — )■ {0, 1} such that, for any given {5Nd + l)-partite non- 
signaling distribution P(ai, . . . ajv^, e|xi, . . . xjv^, z) = P(fe, e\y, z), the random variable k — /(maj(ai), . . . maj(ajv^)) satisfies 



^max^ jp(fc,eiy,2) - ^P(e|j/,2)| < {aC + pi)^'^" ■ P{B\Y) 



(D6) 



for all inputs y — (xi, . . . xjv^) G X^''-, and where a and /3 are real numbers such that < a < 1 < p. 

Proof of Lemma[T) For any xo G A" let MJ" be the vector with components (a, x) = 5maj(a)'^J°- The probability of getting 
maj(a) — w when using xo as input can be written as P(ii;jxo) = ■ P(A|X). Note that this probability can also be written as 
P(w|xo) = rj," ■ P(AjX), where P^" = AI^" + A^' and is any vector orthogonal to the no-signaling subspace, that is, such 
that A^" ■ P(A|X) = for all no-signaling distribution P(A|X). We can then write the left-hand side of l|D6} as 



^max^ P{k,e\y,z) - ^P{e\y,z] 



E i^n^) - I) PMy,e,z) 



^max^P(e|2) ^ fs'};^, - ^ ((g) F-) ■ P(P| 

fee w ^ ^ \i = l / 



F, e, z] 



(D7) 
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where in the last equaUty we have used no-signahng through P{e\y, z) = P{e\z) and the fact that the probability of obtaining the 
string of majorities w when inputting y = (xi, . . . Xiv^) G X^'' can be written as 



PMy) = 



P{B\Y). 



(D8) 



In what follows, the absolute value of vectors is understood to be component- wise. Bound l |D7| l can be rewritten as 



k e 

< ^max^P(elz) 



P{k,e\y,z) - -P{e\y,z) 



E(^/(w)- J)(8)r^- ■PiB\Y,e,z) 
^P{e\z)P{B\Y,e,z) 



= E 



E ( ^/(w) 



\Vl\ ■P{B\Y), 



(D9) 



where the inequality follows from the fact that all the components of the vector P[B\Y, e, z) are positive and no-signalling has been 
used again through P[B\Y, z) = P{B\Y) in the last equality. The bound applies to any function / and holds for any choice of vectors 
A J* in . In what follows, we compute this bound for a specific choice of these vectors and function /. 

Take to be equal to the vectors A^" in Lemma[3] These vectors then satisfy the bounds (|D20J and l |D29[ ) in the same Lemma. 
Take / to be equal to the function whose existence is proven in Lemma |4] Note that the conditions needed for this Lemma to apply 

" > 7 = 0.9732. 



are satisfied because of bound I D20 1 in Lemmajs] and because the free parameter Nd > 130 satisfies (3\/ Nd) 
With this choice of / and AJ^' ' '^'^ 



bound (|D9b becomes 



P{k,e\y,z)- -P{e\y,z) 



< E^^ 0""" -PiBlY) 



< 6VNd{aC + 131)'^'^'' ■ P{B\Y) , 



(DIO) 



where we have used $1^* = \/ (ro')^ + (^1')^, X]* 3 = 6, bound 1 D20 1 in Lemmajsjand bound |D29 1 in Lemma|4] 



□ 



2. Statement and proof of Lemma[2] 

In this section we prove Lemma|2] This Lemma bounds the Bell violation in the distillation block in terms of the probability of not 
aborting the protocol in step 4 and the number and size of the blocks, Nb and Nd- 

Lemma 2. Let P(6i, . . . fejv^lj/i, . • • Vn^) be a (5Af£iA^i,)-partite no-signaling distribution, j/i, . . . j/jv^ and I the variables generated in 
steps 2 and 3 of the protocol, respectively, and a and /3 real numbers such that < a < 1 < /3; then 



(aC + pi) 



P{B\Y,g^ 1) < a" + 



Nd . 2iV, 



log2{l-<!) 



P{9 



5\Nd 



(DU) 



Proof of Lemma m According to definition |C3' we have 7(ai,Xi) < S'^ib y] for all values of 6 = (ai,...a]v^) and y = 
(xi, . . . xjv^). This also implies /(a^, Xi)7(aj, Xj) < S^l[t y] s° Due to the property < a < 1 < /3, one has that 
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(q 2-^)^''-'/3' < 13'^" for any z = 1, . . . Nd- All this in turn implies 

= (a 2-5) + (a 2-5) ^^"^ /3 ^ /, + (a 2-^) /J^ ^ 7,7, + • ■ • 

< (a2-5)^'' +/3^- (2^- - 1) 5,Vyl < (a 2-5)'^'' + (/3 2)^- 5,%,, , (D12) 
where 7i = I{sLi,-x.i). This implies that 

{aC + PI)'^'^-' ■ P{B\Y,g = 1) 

Nd. 

= J2 n["2"'+/3/(a»,xO]P(ai,...aivJxi,...Xiv,,5 = l) 

ai,...ajv , xi,...xjVj » = 1 



< ^ [(a2-5)^'^ + {2(3r-e^^ Pib\y,g = 1) 
b,y 

= a'^'' + (2/3)^''^P(r = 0ly,5 = l) 

= + (2/3)-^ ^ "^(^pT^'^'g^;^^ . (D13) 

We can now bound P{y\g — 1) taking into account that y denotes a SA^d-bit string generated by the e-source 5 that remains after step 2 
in the protocol. Note that only half of the 32 possible 5-bit inputs x generated by the source belong to X and remain after step 2. Thus, 
P((xi, . . . ,Xiv^) € X^-'lg = 1) < 16^'*(1 - ef^", where we used This, together with P((xi, . . . ,X]vJ|g = 1) > e^^"" 
implies that 



P{y\9 = l)>{j^^^] ■ (D14) 



Substituting this bound in l|D13|l, and summing over y, gives 



{aC + 131 ■ P{B\Y, g = l) < a^" + {213 f" ( ''^" ] " P{r = OI5 = 1) . (D15) 



In what follows we use the notation 

P(li,02,l3,l4,...) =P('^[&i,J/i] = I,r[h,y2]=0,r[h,y3] = l,r[&4,t/4] = 1,...) 



According to iC4i, the protocol aborts (g = 0) if there is at least a "not right" block {r[bj,yj] = for some j 7^ 0- While abortion 
also happens if there are more than one "not right" block, in what follows we lower-bound P{g — 0) by the probability that there is 
only one "not right" block: 

1 > P(5 = 0) 

Nt iVb 

^ E P(li,---li-i,li+i,---li'-i,0,.,lr+i,...livj 

^ Yl E ^(li' • • • I'-i' 1'' I'+i' • • • l;'-i,Oi', li'+i, . . . livj 
I I'j^i 

= E [Ei^r^'W] P(ii,...ii-i,ii,ii+i,...ii'-i,Or,ii'+i,...i^J 

I' 
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where, when performing the sum over I, we have used that P(li, . . . 1;, . . . 0;/ , Ij'+i, . . . IjVj^ 



P(li, . . . li'-i, Oi' , li'+i , . . . 1]V[,) does not depend on I. Bound i C2 1 imphes 

P{1) '- (l-e)i°g2iV6 " '- 2 

where the last inequality holds for sufficiently large A^'f,. Using this and ( |D16^ , we obtain 



1 > P(;')nii,---l;'-i,Or,li'+i,...b 



I' 



> ^^r' = 0,5 = 1), (D18) 



where r = r[bi,yi]. This together with i D 1 5 i implies 



{aC + pif''^-P{B\Y,g^l) < a"^ + (2/3)^^ ^^^^^^ ^ P(f ^ 0|g = 1) 
where, in the second inequality, Bayes rule was again invoked. Inequality jD19[>, in turn, implies JdTTI. □ 



3. Statement and proof of the additional Lemmas 

Lemma 3. For each xo G A' there are three vectors Aq " , A^" , Aj" orthogonal to the non-signaling subspace such that for all w G 
{0, 1} and a, X G {0, 1}^ they satisfy 

^J [M^" (a, x) + A;^° (a, x)]' + [A/f « (a, x) + A^" (a, x)]' < QC(a, x) + /37(a, x) + A^« (a, x) (D20) 

and 

|M;°(a,x) + AJ''(a,x)| < 7\/[AC (a, x) + A^» (a, x)]' + [A/f" (a, x) + Af (a, x)]' (D21) 
where a = 0.8842, P = 1.260 and 7 = 0.9732. 

Proof of Lemma|3l The proof of this lemma is numeric but rigorous. It is based on two linear-programming minimization problems, 
which are carried for each value of xo G X. We have repeated this process for different values of 7, finding that 7 = 0.9732 is roughly 
the smallest value for which the linear-programs described below are feasible. 

The fact that the vectors Aq° , A^° , Aj" are orthogonal to the non-signaling subspace can be written as linear equalities 

-D • Ajo = (D22) 

for w G {0,1,2}, where is the zero vector and D is a matrix whose rows constitute a basis of non-signaling 
probability distributions. A geometrical interpretation of constraint l |D20^ is that the point in the plane with coordinates 
\Mq° (a, x) + Ao° (a, x), (a, x) + A^" (a, x)] G is inside a circle of radius a£(a, x) + (31 {a, x) + Aj" (a, x) centered 
at the origin. All points inside an octagon inscribed in this circle also satisfy constraint l |D20^ . The points of such an inscribed octagon 
are the ones satisfying the following set of linear constraints: 

[M^" (a, x) + A^« (a, x)] cos 6^ + [Afr« (a, x) + Af (a, x)] r; sin 6 
< aC(a,x) + /3/(a,x) + A2°(a,x) , (D23) 



for all 6 G {J, ^, ^, ^, ^, 1|^}, where 77 = (cos |)"^ « 1.0 82. In other words, the eight conditions iD23i imply 

constraint ( |D20^ . From now on, we only consider these eight linear constraints l |D23[ l. With a bit of algebra, one can see that inequal- 
ity |D2T]( is equivalent to the two almost linear inequalities there was an error in the following equation, as the pre-factor in terms of 7 
was wrong. Please check what was computed and how it affects to 7 and, then, to the value of Nd 



± [Ml° (a, x) + A^° (a, x)] < ^ / | AfJ" (a, x) + A^" (a, x) | , (D24) 

for all ui G {0, 1}, where w = 1 — to. Clearly, the problem is not linear because of the absolute values. The computation described in 
what follows constitutes a trick to make a good guess for the signs of the terms in the absolute value of l |D24| (, so that the problem can 
be made linear by adding extra constraints. 

The first computational step consists of a linear-programming minimization of a subject to the constraints l |D22[ (, l |D23[ l, where the 
minimization is performed over the variables a, (3, , A^" , Aj" . This step serves to guess the signs 

a„(a,x) = sign[AC'(a,x) + A^''(a,x)] , (D25) 
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for all TO, a, X, where the value of (a, x) corresponds to the solution of the above minimization. Once we have identified all these 
signs, we can write the inequalities (|D24^ in a linear fashion: 



a,„(a,x)[M^°(a,x) + A^°(a,x)] > 
(7,„ (a, x) [AC (a, x) + A^" (a, x)] < 



1 — 7' 



■ a-u, (a, x) [M^° (a, x) + AJ" (a, x)] , 



(D26) 
(D27) 



for all TO e {0,1}. 

Th e second computational step consists of a linear-programming minimization of a subjected to the constraints l |D22[ l, ([D23j, ([D26j, 
I D27 1, over the variables a, /?, Aq" , A^ " , Aj" . Clearly, any solution to this problem is also a solution to the original formulation of the 



Lemma. The minimization was performed for any xo G X and the values of a, 13 turned out to be independent of xo G X. These 
obtained numerical values are the ones appearing in the formulation of the Lemma. □ 



Note that Lemma [5] allows one to bound the predictability of maj(a) by a linear function of the 5-party Mermin violation. This 
can be seen by computing F^" • P(AjX) and applying the bounds in the Lemma. In principle, one expects this bound to exist, as 
the predictability is smaller than one at the point of maximal violation, as proven in Theorem [T] and equal to one at the point of no 
violation. However, we were unable to find it. This is why we had to resort to the linear optimization technique given above, which 
moreover provides the bounds l |D20[ ) and l |D21[ ( necessary for the security proof. 



Lemma 4. Let A^d be a positive integer and let F^, (a, x) be a given set of real coefficients such that for all i G {1, . . . Nd},w G {0,1} 
and a, xG{0,1}^ they satisfy 



|rL(a,x)] < (^3\/iVdj a(a,x) 



(D28) 



where r2i(a, x) = \/FQ(a, x)^ + F^(a, x)^. There exists a function / : {0,1}'^'' — > {0,1} such that for each sequence 
(ai,xi), . . . (ajvj,xjvj) we have 



w ^ 



< 3^ 



(D29) 



where the sum runs over all w — (toi, . . . wjv^) G {0, l}^"*. 



Proof of Lemma l|4j. First, note that for a sequence (ai , xi ) , . . . (a]v^ , xat^ ) for which there is at least one value of i G { 1 , • • • Nd } 
satisfying Fo(ai,Xi) = Fl(ai,Xi) = 0, both the left-hand side and the right-hand side of iD29' are equal to zero, hence, inequal- 
ity I D29| is satisfied independently of the function /. Therefore, in what follows, we only consider sequences (ai , xi ) , . . . (a]v^ , xat^ ) 
for which either Fo(ai, Xi) 7^ or Fi (a,;, Xi) 7^ 0, for alH = 1, . . . Nd- Or, equivalently, we consider sequences such that 



]Jni(ai,Xi) > . 



(D30) 



The existence of the function / satisfying l[D29j for all such sequences is shown with a probabilistic argument. We consider the 
situation where / is picked from the set of all functions mapping {0,1}'^'* to {0,1} with uniform probability, and upper-bound 
the probability that the chosen function does not satisfy the constraint iD29i for all k and all sequences (ai,xi), . . . (ajv^ , xat^) 



satisfying l |D30[ l. This upper bound is shown to be smaller than one. Therefore there must exist at least one function satisfying ([D29}. 

ForeachwG {0, 1}^'' consider the random variable _Fw = (^/(w)^|) ^ { |, —|}, where / is picked from the set of all functions 
mapping {0, l}^'' — >■ {0, 1} with uniform distribution. This is equivalent to saying that the 2^'' random variables {^^{w are indepen- 
dent and identically distributed according to Pr{Fw = i|} = |- For sase of notation, let us fix a sequence (ai, xi), . . . (a]v^ , xat^) 
satisfying 1 D30 1 and use the short-hand notation FJ„. = FJ„, (ai, Xi). 
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< E 



We proceed using the same ideas as in tlie derivation of the exponential Chebyshev's Inequality. For any /i, > 0, we have 

Pr ^FwHrL. >M 

w i — l 

= Prj^^-M + ^FwHrL. ) >0] 

■i expl -i./i + '^X^^wnru.. ) > 1 
exp I + ^ Fw n rj, 

\ w i — l 

( N 

W \ Z — 1 > 

exp 

V i = l / 

1 + /^Fw n rl. + n rL 



(D31) 



< e" 



nE 

w 

nE 



(D32) 



(D33) 



He re E s tands for the average over allFw. In i (D3T| we have used th at any positive random variable X satisfies Pr{X > 1} < E[X]. 
In I D32 I we have used that the {Fw}w are independent. Finally, in i D33 i we have used that e'' < 1 + r; + r;^, which is only valid if 
77 < 1. Therefore, we must show that 



< 1, 



(D34) 



which is done below, when setting the value of v. In what follows we use the chain of inequalities 1 D33 1, the fact that E[Fw] = and 
E[Fw] = 1/4, bound 1 + 77 < e" for 77 > 0, and the definition = {Thf + {T\)^: 



W Z — 1 



/ 2 , 

W \ Z — 1 



< e-n-pM:rn(r 



_ 2 



exp -!^M+i]xn(ru.. 



2 



exp I -vii+ 



(D35) 



In order to optimize this upper bound, we minimize the exponent over v. This is done by differentiating with respect to v and equating 
to zero, which gives 



(D36) 



Note that constraint l |D30[ ) implies that the inverse of Jl; exists. Since we assume ^ > 0, the initial assumption !/ > is satisfied by 
the solution l |D36[ l. By substituting |D36| in l |D35[ l and rescaling the free parameter /i as 

(D37) 



we obtain 



Pr<^^Fwnrt,, > AH"" f ^« 



(D38) 
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for any jl> consistent with condition i D34 1. We now chioose — 3\/Nd, see Eq. jD29|, getting 

K_ w i — 1 i — 1 ) 

With this assignment, and using l |D36[ l and l[D37j, condition l |D34[ l, yet to be fulfilled, becomes 



< 1 



(D39) 



(D40) 



which no w hold s because of the initial premise |D28|. 

Bound \D39\ applies to each of the sequences (ai, xi), . . . (ajv^ , xjv^) satisfying | |D30[ i, and there are at most 4^^<' of them. Hence, 
the probability that the random function / does not satisfy the bound 



Nd Nd 

^ n > 3\/iVd n 

W Z— 1 1—1 



(D41) 



for at least one of such sequences, is at most 4^'^''e which is smaller than 1/2 for any value of N^. A similar argument proves 
that the probability that the random function / does not satisfy the bound 

Nd Nd 

^ n (D42) 

w i— 1 i — 1 

for at least one sequence satisfying ( |D30^ is also smaller than 1/2. The lemma now easily follows from these two results. □ 



Appendix E: Final remarks 



The main goal of our work was to prove full randomness amplification. In these appendices, we have shown how our protocol, 
based on quantum non-local correlations, achieves this task. Unfortunately, we are not able to provide an explicit description of the 
function / : {0, 1}^'' -> {0, 1} which maps the outcomes of the black boxes to the final random bit k; we merely show its existence. 
Such function may be obtained through an algorithm that searches over the set of all functions until it finds one satisfying |D29]l. The 
problem with this method is that the set of all functions has size 2^'' , which makes the search computationally costly. However, this 
problem can be fixed by noticing that the random choice of / in the proof of Lemma |4] can be restricted to a four-universal family of 
functions, with size polynomial in Nd- This observation will be developed in future work. 

A more direct approach could consist of studying how the randomness in the measurement outcomes for correlations maximally 
violating the Mermin inequality increases with the number of parties. We solved linear optimization problems similar to those used in 
TheoremfTlwhich showed that for 7 parties Eve's predictability is 2/3 for a function of 5 bits defined by /(OOOOO) = 0, /(Ollll) = 0, 
/(00111) = and /(x) — 1 otherwise. Note that this value is lower than the earlier 3/4 and also that the function is different from the 
majority- vote. We were however unable to generalize these results for an arbitrary number of parties, which forced us to adopt a less 
direct approach. Note in fact that our protocol can be interpreted as a huge multipartite Bell test from which a random bit is extracted 
by classical processing of some of the measurement outcomes. 

We conclude by stressing again that the reason why randomness amplification becomes possible using non-locality is because 
the randomness certification is achieved by a Bell inequality violation. There already exist several protocols, both in classical and 
quantum information theory, in which imperfect randomness is processed to generate perfect (or arbitrarily close to perfect) randomness. 
However, all these protocols, e.g. two-universal hashing or randomness extractors, always require additional good-quality randomness 
to perform such distillation. On the contrary, if the initial imperfect randomness has been certified by a Bell inequality violation, the 
distillation procedure can be done with a deterministic hash function (see 16J or Lemma[T|above). This property makes Bell-certified 
randomness fundamentally different from any other form of randomness, and is the key for the success of our protocol. 
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